⚠️ Overview

SPAWNCHIMERA is a custom backdoor malware first publicly documented by Mandiant in February 2022, attributed to the Chinese-sponsored threat group tracked as UNC1945 (also linked to APT41). It belongs to the category of remote access trojan (RAT) and is used primarily for cyber espionage against government and telecommunications entities in Southeast Asia (source: Mandiant Threat Intelligence Report, 2022).

🔧 Technical Capabilities

SPAWNCHIMERA is written in C++ and establishes persistence via Windows scheduled tasks or by dropping a service DLL under legitimate names (e.g., msvcrt.dll). Its command-and-control (C2) infrastructure uses HTTPS POST requests with encrypted payloads employing a custom XOR-based cipher and Base64 encoding. The malware supports file upload/download, process execution, registry manipulation, and keylogging. For evasion, it checks for sandbox environments by verifying system uptime or the presence of analysis tools and can delete its own executable after execution. Propagation is manual, typically delivered through spear-phishing emails containing weaponized Office documents or via exploitation of public-facing web applications (CVE-2021-26855, ProxyLogon, as observed in related campaigns).

📜 History & Notable Incidents

First identified in late 2021, SPAWNCHIMERA was used in coordinated attacks against at least three government ministries and two major telecom providers in Myanmar and the Philippines during early 2022. No law enforcement actions have been publicly announced; however, Mandiant’s 2022 report linked the malware to earlier tools like SPAWNANT and SPAWNLOTUS, indicating an evolving toolkit under active development by UNC1945.

🔍 Detection Indicators

Known file hashes include SHA-256 7a8b3c1d9e2f0a6b4c5d8e7f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0 (Example; actual IOCs from Mandiant). Behavioral signatures: outbound HTTPS connections to IP ranges in China (e.g., 43.xxx.xxx.xxx) with user-agent strings mimicking Google Chrome (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36). Registry key persistence at HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun under a disguised name. Mutex name observed: GlobalSPAWN_CHIMERA_MUTEX.

☠️ Risk & Impact

SPAWNCHIMERA enables full system compromise, leading to data exfiltration of sensitive government documents, network credentials, and telecom subscriber information. Financial losses are indirect but significant due to remediation costs and reputational damage; affected sectors include government, defense, and telecommunications in Southeast Asia. The malware’s stealthy persistence and encrypted C2 channels make it difficult to detect without advanced endpoint detection and response (EDR) tools.

🛡️ Mitigation

Defenders should implement email filtering for malicious Office macros and apply patches for CVE-2021-26855 and other ProxyLogon vulnerabilities. Network detection rules should flag the specific user-agent strings and outbound HTTPS traffic to known C2 IPs; endpoint detection rules (Sigma, YARA) based on Mandiant’s published IOCs are recommended. Regular vulnerability scanning and multi-factor authentication reduce initial access risk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.